@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/supply-chain/ecs-deployed-image.js

@@ -0,0 +1,300 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ECS_DEPLOYED_IMAGE_BINDING_SCHEMA_VERSION = exports.ECS_DEPLOYED_IMAGE_BINDING_KIND = void 0;
+exports.collectEcsDeployedImageBinding = collectEcsDeployedImageBinding;
+exports.verifyEcsDeployedImageBinding = verifyEcsDeployedImageBinding;
+const validation_js_1 = require("../validation.js");
+const common_js_1 = require("./common.js");
+const errors_js_1 = require("./errors.js");
+const ACCOUNT = /^\d{12}$/;
+const COMMIT = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/;
+const IMAGE_DIGEST = /^sha256:[a-f0-9]{64}$/;
+const REGION = /^[a-z]{2}(?:-gov)?-[a-z]+(?:-[a-z]+)*-\d$/;
+const REPOSITORY = /^[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*(?:\/[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*)*$/;
+const TASK_FAMILY = /^[A-Za-z0-9][A-Za-z0-9_-]{0,254}$/;
+exports.ECS_DEPLOYED_IMAGE_BINDING_KIND = 'ebk-ecs-deployed-image-binding';
+exports.ECS_DEPLOYED_IMAGE_BINDING_SCHEMA_VERSION = 1;
+function fail(path, message, classification = 'supply-chain-input-invalid') {
+    throw new errors_js_1.SupplyChainError(classification, path, message);
+}
+function exactReference(value, path, pattern = common_js_1.SUPPLY_CHAIN_REFERENCE) {
+    if (typeof value !== 'string' || value.length > 512 || !pattern.test(value)) {
+        return fail(path, 'must be one bounded exact reference');
+    }
+    return value;
+}
+function validateExpected(value) {
+    const accountId = exactReference(value.accountId, 'expected.accountId', ACCOUNT);
+    const region = exactReference(value.region, 'expected.region', REGION);
+    const containerImageDigest = exactReference(value.containerImageDigest, 'expected.containerImageDigest', IMAGE_DIGEST);
+    const repositoryName = exactReference(value.repositoryName, 'expected.repositoryName', REPOSITORY);
+    const registrySuffix = region.startsWith('cn-') ? '.com.cn' : '.com';
+    const expectedImageReference = `${accountId}.dkr.ecr.${region}.amazonaws${registrySuffix}/` +
+        `${repositoryName}@${containerImageDigest}`;
+    if (value.imageReference !== expectedImageReference) {
+        return fail('expected.imageReference', 'must be the exact digest-qualified image in the expected ECR repository');
+    }
+    return {
+        accountId,
+        artifactId: exactReference(value.artifactId, 'expected.artifactId'),
+        candidateArtifactDigest: exactReference(value.candidateArtifactDigest, 'expected.candidateArtifactDigest', common_js_1.SUPPLY_CHAIN_SHA256),
+        containerBindingDigest: exactReference(value.containerBindingDigest, 'expected.containerBindingDigest', common_js_1.SUPPLY_CHAIN_SHA256),
+        containerImageDigest,
+        deployment: validateDeploymentSelector(value.deployment, accountId, region),
+        imageReference: expectedImageReference,
+        region,
+        releaseId: exactReference(value.releaseId, 'expected.releaseId'),
+        releaseManifestDigest: exactReference(value.releaseManifestDigest, 'expected.releaseManifestDigest', common_js_1.SUPPLY_CHAIN_SHA256),
+        releaseManifestMaterialDigest: exactReference(value.releaseManifestMaterialDigest, 'expected.releaseManifestMaterialDigest', common_js_1.SUPPLY_CHAIN_SHA256),
+        repositoryName,
+        sourceCommit: exactReference(value.sourceCommit, 'expected.sourceCommit', COMMIT),
+        stage: value.stage === 'production' || value.stage === 'staging'
+            ? value.stage
+            : fail('expected.stage', 'must identify one protected stage'),
+        taskDefinitionFamily: exactReference(value.taskDefinitionFamily, 'expected.taskDefinitionFamily', TASK_FAMILY),
+    };
+}
+function validateDeploymentSelector(value, accountId, region) {
+    if (!(0, validation_js_1.isRecord)(value)) {
+        return fail('expected.deployment', 'must identify one exact deployed ECS service or task');
+    }
+    const partition = 'aws(?:-us-gov|-iso(?:-[a-z]+)?)?';
+    const clusterArn = exactReference(value.clusterArn, 'expected.deployment.clusterArn', new RegExp(`^arn:${partition}:ecs:${region}:${accountId}:cluster/[A-Za-z0-9_./-]{1,255}$`));
+    if (value.kind === 'service' &&
+        Object.keys(value).sort().join('\0') ===
+            ['clusterArn', 'kind', 'serviceArn'].join('\0')) {
+        return {
+            clusterArn,
+            kind: 'service',
+            serviceArn: exactReference(value.serviceArn, 'expected.deployment.serviceArn', new RegExp(`^arn:${partition}:ecs:${region}:${accountId}:service/[A-Za-z0-9_./-]{1,511}$`)),
+        };
+    }
+    if (value.kind === 'task' &&
+        Object.keys(value).sort().join('\0') ===
+            ['clusterArn', 'kind', 'taskArn'].join('\0')) {
+        return {
+            clusterArn,
+            kind: 'task',
+            taskArn: exactReference(value.taskArn, 'expected.deployment.taskArn', new RegExp(`^arn:${partition}:ecs:${region}:${accountId}:task/[A-Za-z0-9_./-]{1,511}$`)),
+        };
+    }
+    return fail('expected.deployment', 'must use the exact service or task deployment selector shape');
+}
+function validateProvenance(value) {
+    if (!(0, validation_js_1.isRecord)(value) ||
+        value.tool !== 'aws-cli' ||
+        !/^[1-9]\d*$/.test(String(value.runAttempt)) ||
+        !/^[1-9]\d*$/.test(String(value.runId)) ||
+        typeof value.toolVersion !== 'string' ||
+        !/^aws-cli\/\d+\.\d+\.\d+(?:\s.*)?$/.test(value.toolVersion) ||
+        typeof value.workflow !== 'string' ||
+        !common_js_1.SUPPLY_CHAIN_REFERENCE.test(value.workflow)) {
+        return fail('provenance', 'must identify one exact AWS CLI workflow invocation');
+    }
+    return value;
+}
+function canonicalTimestamp(value, path) {
+    if (typeof value !== 'string' ||
+        !Number.isFinite(Date.parse(value)) ||
+        new Date(value).toISOString() !== value) {
+        return fail(path, 'must be a canonical ISO-8601 timestamp');
+    }
+    return value;
+}
+function deploymentFromCall(call, expected, path) {
+    if (!(0, validation_js_1.isRecord)(call) ||
+        !(0, validation_js_1.isRecord)(call.request) ||
+        (0, common_js_1.canonicalizeSupplyChainValue)(call.request) !==
+            (0, common_js_1.canonicalizeSupplyChainValue)({
+                ...expected.deployment,
+                region: expected.region,
+            }) ||
+        !(0, validation_js_1.isRecord)(call.response) ||
+        !Array.isArray(call.response.failures) ||
+        call.response.failures.length !== 0) {
+        return fail(path, 'must retain the exact deployed ECS selector request and response', 'supply-chain-scanner-unavailable');
+    }
+    if (expected.deployment.kind === 'service') {
+        if (!Array.isArray(call.response.services) ||
+            call.response.services.length !== 1 ||
+            !(0, validation_js_1.isRecord)(call.response.services[0])) {
+            return fail(path, 'must resolve exactly one deployed ECS service', 'supply-chain-artifact-mismatch');
+        }
+        const service = call.response.services[0];
+        if (service.clusterArn !== expected.deployment.clusterArn ||
+            service.serviceArn !== expected.deployment.serviceArn ||
+            service.status !== 'ACTIVE' ||
+            typeof service.taskDefinition !== 'string' ||
+            !Array.isArray(service.deployments) ||
+            service.deployments.length !== 1 ||
+            !(0, validation_js_1.isRecord)(service.deployments[0]) ||
+            service.deployments[0].status !== 'PRIMARY' ||
+            service.deployments[0].rolloutState !== 'COMPLETED' ||
+            service.deployments[0].taskDefinition !== service.taskDefinition) {
+            return fail(path, 'must resolve one stable completed primary ECS service deployment', 'supply-chain-artifact-mismatch');
+        }
+        return {
+            deploymentArn: expected.deployment.serviceArn,
+            taskDefinitionArn: service.taskDefinition,
+        };
+    }
+    if (!Array.isArray(call.response.tasks) ||
+        call.response.tasks.length !== 1 ||
+        !(0, validation_js_1.isRecord)(call.response.tasks[0])) {
+        return fail(path, 'must resolve exactly one deployed ECS task', 'supply-chain-artifact-mismatch');
+    }
+    const task = call.response.tasks[0];
+    if (task.clusterArn !== expected.deployment.clusterArn ||
+        task.taskArn !== expected.deployment.taskArn ||
+        !['RUNNING', 'STOPPED'].includes(String(task.lastStatus)) ||
+        typeof task.taskDefinitionArn !== 'string') {
+        return fail(path, 'must resolve one exact ECS task execution', 'supply-chain-artifact-mismatch');
+    }
+    return {
+        deploymentArn: expected.deployment.taskArn,
+        taskDefinitionArn: task.taskDefinitionArn,
+    };
+}
+function taskDefinitionFromCall(call, expected, taskDefinitionArn, path) {
+    if (!(0, validation_js_1.isRecord)(call) ||
+        !(0, validation_js_1.isRecord)(call.request) ||
+        call.request.region !== expected.region ||
+        call.request.taskDefinition !== taskDefinitionArn ||
+        !Array.isArray(call.request.include) ||
+        call.request.include.length !== 1 ||
+        call.request.include[0] !== 'TAGS' ||
+        !(0, validation_js_1.isRecord)(call.response) ||
+        !(0, validation_js_1.isRecord)(call.response.taskDefinition)) {
+        return fail(path, 'must retain an exact describe-task-definition request and response', 'supply-chain-scanner-unavailable');
+    }
+    return call.response.taskDefinition;
+}
+function repositoryFromImage(image, expected) {
+    const match = /^(?<account>\d{12})\.dkr\.ecr\.(?<region>[a-z0-9-]+)\.amazonaws\.com(?:\.cn)?\/(?<repository>[a-z0-9][a-z0-9._/-]*)@(?<digest>sha256:[a-f0-9]{64})$/.exec(image);
+    if (!match?.groups ||
+        match.groups.account !== expected.accountId ||
+        match.groups.region !== expected.region ||
+        image !== expected.imageReference ||
+        match.groups.repository !== expected.repositoryName ||
+        !common_js_1.SUPPLY_CHAIN_REFERENCE.test(match.groups.repository ?? '') ||
+        !IMAGE_DIGEST.test(match.groups.digest ?? '')) {
+        return fail('taskDefinition.containerDefinitions[0].image', 'must be an exact digest-qualified image in the expected ECR registry; tag-only SST context builds are unsupported', 'supply-chain-artifact-mismatch');
+    }
+    return {
+        imageDigest: match.groups.digest,
+        repositoryName: match.groups.repository,
+    };
+}
+function environmentMap(value) {
+    if (!Array.isArray(value)) {
+        return fail('taskDefinition.containerDefinitions[0].environment', 'must retain exact release identity environment values', 'supply-chain-artifact-mismatch');
+    }
+    const result = new Map();
+    for (const [index, entry] of value.entries()) {
+        if (!(0, validation_js_1.isRecord)(entry) ||
+            typeof entry.name !== 'string' ||
+            typeof entry.value !== 'string' ||
+            result.has(entry.name)) {
+            return fail(`taskDefinition.containerDefinitions[0].environment[${index}]`, 'must contain unique literal environment values', 'supply-chain-artifact-mismatch');
+        }
+        result.set(entry.name, entry.value);
+    }
+    return result;
+}
+function collectEcsDeployedImageBinding(input) {
+    const expected = validateExpected(input.expected);
+    const collectedAt = canonicalTimestamp(input.collectedAt, 'collectedAt');
+    const provenance = validateProvenance(input.provenance);
+    const deployment = deploymentFromCall(input.deployment, expected, 'deployment');
+    const revalidatedDeployment = deploymentFromCall(input.revalidatedDeployment, expected, 'revalidatedDeployment');
+    if ((0, common_js_1.canonicalizeSupplyChainValue)(deployment) !==
+        (0, common_js_1.canonicalizeSupplyChainValue)(revalidatedDeployment)) {
+        return fail('revalidatedDeployment.response', 'changed while the image identity was being collected', 'supply-chain-artifact-mismatch');
+    }
+    const first = taskDefinitionFromCall(input.first, expected, deployment.taskDefinitionArn, 'first');
+    const revalidated = taskDefinitionFromCall(input.revalidated, expected, deployment.taskDefinitionArn, 'revalidated');
+    if ((0, common_js_1.canonicalizeSupplyChainValue)(first) !==
+        (0, common_js_1.canonicalizeSupplyChainValue)(revalidated)) {
+        return fail('revalidated.response.taskDefinition', 'changed while the image identity was being collected', 'supply-chain-artifact-mismatch');
+    }
+    const taskDefinitionArn = exactReference(first.taskDefinitionArn, 'taskDefinition.taskDefinitionArn', new RegExp(`^arn:aws(?:-us-gov|-iso(?:-[a-z]+)?)?:ecs:${expected.region}:${expected.accountId}:task-definition/${expected.taskDefinitionFamily}:[1-9]\\d*$`));
+    if (taskDefinitionArn !== deployment.taskDefinitionArn) {
+        return fail('taskDefinition.taskDefinitionArn', 'differs from the exact deployed service or task revision', 'supply-chain-artifact-mismatch');
+    }
+    if (first.family !== expected.taskDefinitionFamily ||
+        first.status !== 'ACTIVE' ||
+        !Array.isArray(first.containerDefinitions) ||
+        first.containerDefinitions.length !== 1 ||
+        !(0, validation_js_1.isRecord)(first.containerDefinitions[0])) {
+        return fail('taskDefinition', 'must be one active exact-family task definition with one container', 'supply-chain-artifact-mismatch');
+    }
+    const container = first.containerDefinitions[0];
+    if (typeof container.name !== 'string' ||
+        !common_js_1.SUPPLY_CHAIN_REFERENCE.test(container.name) ||
+        typeof container.image !== 'string' ||
+        container.essential === false) {
+        return fail('taskDefinition.containerDefinitions[0]', 'must be one named essential container with an exact image', 'supply-chain-artifact-mismatch');
+    }
+    const environment = environmentMap(container.environment);
+    for (const [name, value] of Object.entries({
+        EBK_CONTAINER_BINDING_DIGEST: expected.containerBindingDigest,
+        EBK_CONTAINER_IMAGE_DIGEST: expected.containerImageDigest,
+        EBK_RELEASE_ARTIFACT_DIGEST: expected.candidateArtifactDigest,
+        EBK_RELEASE_ARTIFACT_ID: expected.artifactId,
+        EBK_SOURCE_COMMIT: expected.sourceCommit,
+        EBK_STAGE: expected.stage,
+    })) {
+        if (environment.get(name) !== value) {
+            return fail(`taskDefinition.containerDefinitions[0].environment.${name}`, 'does not bind the exact release candidate and manifest', 'supply-chain-artifact-mismatch');
+        }
+    }
+    const image = repositoryFromImage(container.image, expected);
+    if (image.imageDigest !== expected.containerImageDigest) {
+        return fail('taskDefinition.containerDefinitions[0].image', 'differs from the exact predeploy multi-architecture image binding', 'supply-chain-artifact-mismatch');
+    }
+    const unsigned = {
+        ...expected,
+        collectedAt,
+        containerName: container.name,
+        deploymentArn: deployment.deploymentArn,
+        deploymentKind: expected.deployment.kind,
+        imageDigest: image.imageDigest,
+        imageReference: container.image,
+        kind: exports.ECS_DEPLOYED_IMAGE_BINDING_KIND,
+        provenance,
+        rawCalls: [
+            {
+                requestDigest: (0, common_js_1.supplyChainDigest)(input.deployment.request),
+                responseDigest: (0, common_js_1.supplyChainDigest)(input.deployment.response),
+            },
+            {
+                requestDigest: (0, common_js_1.supplyChainDigest)(input.first.request),
+                responseDigest: (0, common_js_1.supplyChainDigest)(input.first.response),
+            },
+            {
+                requestDigest: (0, common_js_1.supplyChainDigest)(input.revalidatedDeployment.request),
+                responseDigest: (0, common_js_1.supplyChainDigest)(input.revalidatedDeployment.response),
+            },
+            {
+                requestDigest: (0, common_js_1.supplyChainDigest)(input.revalidated.request),
+                responseDigest: (0, common_js_1.supplyChainDigest)(input.revalidated.response),
+            },
+        ],
+        repositoryName: image.repositoryName,
+        schemaVersion: exports.ECS_DEPLOYED_IMAGE_BINDING_SCHEMA_VERSION,
+        taskDefinitionArn,
+    };
+    return { ...unsigned, materialDigest: (0, common_js_1.supplyChainDigest)(unsigned) };
+}
+function verifyEcsDeployedImageBinding(value, expected) {
+    const validated = validateExpected(expected);
+    const { materialDigest, ...unsigned } = value;
+    if (value.kind !== exports.ECS_DEPLOYED_IMAGE_BINDING_KIND ||
+        value.schemaVersion !== exports.ECS_DEPLOYED_IMAGE_BINDING_SCHEMA_VERSION ||
+        Object.entries(validated).some(([key, expectedValue]) => (0, common_js_1.canonicalizeSupplyChainValue)(value[key]) !== (0, common_js_1.canonicalizeSupplyChainValue)(expectedValue)) ||
+        materialDigest !== (0, common_js_1.supplyChainDigest)(unsigned)) {
+        throw new errors_js_1.SupplyChainError('supply-chain-artifact-mismatch', 'ecsDeployedImageBinding', 'does not bind the exact expected deployed release image');
+    }
+    return value;
+}
+//# sourceMappingURL=ecs-deployed-image.js.map

package/src/supply-chain/ecs-deployed-image.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ecs-deployed-image.js","sourceRoot":"","sources":["../../../../../packages/nx/src/supply-chain/ecs-deployed-image.ts"],"names":[],"mappings":";;;AA8bA,wEAwJC;AAED,sEAwBC;AAhnBD,oDAA4C;AAC5C,2CAKqB;AACrB,2CAA+C;AAG/C,MAAM,OAAO,GAAG,UAAU,CAAC;AAC3B,MAAM,MAAM,GAAG,iCAAiC,CAAC;AACjD,MAAM,YAAY,GAAG,uBAAuB,CAAC;AAC7C,MAAM,MAAM,GAAG,2CAA2C,CAAC;AAC3D,MAAM,UAAU,GACd,qFAAqF,CAAC;AACxF,MAAM,WAAW,GAAG,mCAAmC,CAAC;AAE3C,QAAA,+BAA+B,GAC1C,gCAAyC,CAAC;AAC/B,QAAA,yCAAyC,GAAG,CAAU,CAAC;AAmEpE,SAAS,IAAI,CACX,IAAY,EACZ,OAAe,EACf,iBAGyC,4BAA4B;IAErE,MAAM,IAAI,4BAAgB,CAAC,cAAc,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,cAAc,CACrB,KAAc,EACd,IAAY,EACZ,UAAkB,kCAAsB;IAExC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5E,OAAO,IAAI,CAAC,IAAI,EAAE,qCAAqC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAiC;IAEjC,MAAM,SAAS,GAAG,cAAc,CAC9B,KAAK,CAAC,SAAS,EACf,oBAAoB,EACpB,OAAO,CACR,CAAC;IACF,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC;IACvE,MAAM,oBAAoB,GAAG,cAAc,CACzC,KAAK,CAAC,oBAAoB,EAC1B,+BAA+B,EAC/B,YAAY,CACb,CAAC;IACF,MAAM,cAAc,GAAG,cAAc,CACnC,KAAK,CAAC,cAAc,EACpB,yBAAyB,EACzB,UAAU,CACX,CAAC;IACF,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IACrE,MAAM,sBAAsB,GAC1B,GAAG,SAAS,YAAY,MAAM,aAAa,cAAc,GAAG;QAC5D,GAAG,cAAc,IAAI,oBAAoB,EAAE,CAAC;IAC9C,IAAI,KAAK,CAAC,cAAc,KAAK,sBAAsB,EAAE,CAAC;QACpD,OAAO,IAAI,CACT,yBAAyB,EACzB,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,OAAO;QACL,SAAS;QACT,UAAU,EAAE,cAAc,CAAC,KAAK,CAAC,UAAU,EAAE,qBAAqB,CAAC;QACnE,uBAAuB,EAAE,cAAc,CACrC,KAAK,CAAC,uBAAuB,EAC7B,kCAAkC,EAClC,+BAAmB,CACpB;QACD,sBAAsB,EAAE,cAAc,CACpC,KAAK,CAAC,sBAAsB,EAC5B,iCAAiC,EACjC,+BAAmB,CACpB;QACD,oBAAoB;QACpB,UAAU,EAAE,0BAA0B,CAAC,KAAK,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC;QAC3E,cAAc,EAAE,sBAAsB;QACtC,MAAM;QACN,SAAS,EAAE,cAAc,CAAC,KAAK,CAAC,SAAS,EAAE,oBAAoB,CAAC;QAChE,qBAAqB,EAAE,cAAc,CACnC,KAAK,CAAC,qBAAqB,EAC3B,gCAAgC,EAChC,+BAAmB,CACpB;QACD,6BAA6B,EAAE,cAAc,CAC3C,KAAK,CAAC,6BAA6B,EACnC,wCAAwC,EACxC,+BAAmB,CACpB;QACD,cAAc;QACd,YAAY,EAAE,cAAc,CAC1B,KAAK,CAAC,YAAY,EAClB,uBAAuB,EACvB,MAAM,CACP;QACD,KAAK,EACH,KAAK,CAAC,KAAK,KAAK,YAAY,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;YACvD,CAAC,CAAC,KAAK,CAAC,KAAK;YACb,CAAC,CAAC,IAAI,CAAC,gBAAgB,EAAE,mCAAmC,CAAC;QACjE,oBAAoB,EAAE,cAAc,CAClC,KAAK,CAAC,oBAAoB,EAC1B,+BAA+B,EAC/B,WAAW,CACZ;KACF,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CACjC,KAA8B,EAC9B,SAAiB,EACjB,MAAc;IAEd,IAAI,CAAC,IAAA,wBAAQ,EAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,IAAI,CACT,qBAAqB,EACrB,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,kCAAkC,CAAC;IACrD,MAAM,UAAU,GAAG,cAAc,CAC/B,KAAK,CAAC,UAAU,EAChB,gCAAgC,EAChC,IAAI,MAAM,CACR,QAAQ,SAAS,QAAQ,MAAM,IAAI,SAAS,kCAAkC,CAC/E,CACF,CAAC;IACF,IACE,KAAK,CAAC,IAAI,KAAK,SAAS;QACxB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;YAClC,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EACjD,CAAC;QACD,OAAO;YACL,UAAU;YACV,IAAI,EAAE,SAAS;YACf,UAAU,EAAE,cAAc,CACxB,KAAK,CAAC,UAAU,EAChB,gCAAgC,EAChC,IAAI,MAAM,CACR,QAAQ,SAAS,QAAQ,MAAM,IAAI,SAAS,kCAAkC,CAC/E,CACF;SACF,CAAC;IACJ,CAAC;IACD,IACE,KAAK,CAAC,IAAI,KAAK,MAAM;QACrB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;YAClC,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAC9C,CAAC;QACD,OAAO;YACL,UAAU;YACV,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,cAAc,CACrB,KAAK,CAAC,OAAO,EACb,6BAA6B,EAC7B,IAAI,MAAM,CACR,QAAQ,SAAS,QAAQ,MAAM,IAAI,SAAS,+BAA+B,CAC5E,CACF;SACF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CACT,qBAAqB,EACrB,8DAA8D,CAC/D,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,KAAwC;IAExC,IACE,CAAC,IAAA,wBAAQ,EAAC,KAAK,CAAC;QAChB,KAAK,CAAC,IAAI,KAAK,SAAS;QACxB,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC5C,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvC,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;QACrC,CAAC,mCAAmC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;QAC5D,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,CAAC,kCAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAC5C,CAAC;QACD,OAAO,IAAI,CACT,YAAY,EACZ,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc,EAAE,IAAY;IACtD,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,EACvC,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,EAAE,wCAAwC,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CACzB,IAA4B,EAC5B,QAAoC,EACpC,IAAY;IAEZ,IACE,CAAC,IAAA,wBAAQ,EAAC,IAAI,CAAC;QACf,CAAC,IAAA,wBAAQ,EAAC,IAAI,CAAC,OAAO,CAAC;QACvB,IAAA,wCAA4B,EAAC,IAAI,CAAC,OAAO,CAAC;YACxC,IAAA,wCAA4B,EAAC;gBAC3B,GAAG,QAAQ,CAAC,UAAU;gBACtB,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC;QACJ,CAAC,IAAA,wBAAQ,EAAC,IAAI,CAAC,QAAQ,CAAC;QACxB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACtC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EACnC,CAAC;QACD,OAAO,IAAI,CACT,IAAI,EACJ,kEAAkE,EAClE,kCAAkC,CACnC,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC3C,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;YACnC,CAAC,IAAA,wBAAQ,EAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EACpC,CAAC;YACD,OAAO,IAAI,CACT,IAAI,EACJ,+CAA+C,EAC/C,gCAAgC,CACjC,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC1C,IACE,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,CAAC,UAAU;YACrD,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,CAAC,UAAU;YACrD,OAAO,CAAC,MAAM,KAAK,QAAQ;YAC3B,OAAO,OAAO,CAAC,cAAc,KAAK,QAAQ;YAC1C,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC;YACnC,OAAO,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;YAChC,CAAC,IAAA,wBAAQ,EAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;YACjC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS;YAC3C,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,YAAY,KAAK,WAAW;YACnD,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,cAAc,KAAK,OAAO,CAAC,cAAc,EAChE,CAAC;YACD,OAAO,IAAI,CACT,IAAI,EACJ,kEAAkE,EAClE,gCAAgC,CACjC,CAAC;QACJ,CAAC;QACD,OAAO;YACL,aAAa,EAAE,QAAQ,CAAC,UAAU,CAAC,UAAU;YAC7C,iBAAiB,EAAE,OAAO,CAAC,cAAc;SAC1C,CAAC;IACJ,CAAC;IACD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QACnC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAChC,CAAC,IAAA,wBAAQ,EAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EACjC,CAAC;QACD,OAAO,IAAI,CACT,IAAI,EACJ,4CAA4C,EAC5C,gCAAgC,CACjC,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACpC,IACE,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,CAAC,UAAU;QAClD,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,UAAU,CAAC,OAAO;QAC5C,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC,iBAAiB,KAAK,QAAQ,EAC1C,CAAC;QACD,OAAO,IAAI,CACT,IAAI,EACJ,2CAA2C,EAC3C,gCAAgC,CACjC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,aAAa,EAAE,QAAQ,CAAC,UAAU,CAAC,OAAO;QAC1C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,IAAgC,EAChC,QAAoC,EACpC,iBAAyB,EACzB,IAAY;IAEZ,IACE,CAAC,IAAA,wBAAQ,EAAC,IAAI,CAAC;QACf,CAAC,IAAA,wBAAQ,EAAC,IAAI,CAAC,OAAO,CAAC;QACvB,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QACvC,IAAI,CAAC,OAAO,CAAC,cAAc,KAAK,iBAAiB;QACjD,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QACpC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QACjC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,MAAM;QAClC,CAAC,IAAA,wBAAQ,EAAC,IAAI,CAAC,QAAQ,CAAC;QACxB,CAAC,IAAA,wBAAQ,EAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EACvC,CAAC;QACD,OAAO,IAAI,CACT,IAAI,EACJ,oEAAoE,EACpE,kCAAkC,CACnC,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;AACtC,CAAC;AAED,SAAS,mBAAmB,CAC1B,KAAa,EACb,QAAoC;IAEpC,MAAM,KAAK,GACT,qJAAqJ,CAAC,IAAI,CACxJ,KAAK,CACN,CAAC;IACJ,IACE,CAAC,KAAK,EAAE,MAAM;QACd,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,SAAS;QAC3C,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QACvC,KAAK,KAAK,QAAQ,CAAC,cAAc;QACjC,KAAK,CAAC,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,cAAc;QACnD,CAAC,kCAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;QAC3D,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAC7C,CAAC;QACD,OAAO,IAAI,CACT,8CAA8C,EAC9C,mHAAmH,EACnH,gCAAgC,CACjC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,MAAgB;QAC1C,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,UAAoB;KAClD,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CACT,oDAAoD,EACpD,uDAAuD,EACvD,gCAAgC,CACjC,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7C,IACE,CAAC,IAAA,wBAAQ,EAAC,KAAK,CAAC;YAChB,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;YAC9B,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;YAC/B,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EACtB,CAAC;YACD,OAAO,IAAI,CACT,sDAAsD,KAAK,GAAG,EAC9D,gDAAgD,EAChD,gCAAgC,CACjC,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,8BAA8B,CAAC,KAQ9C;IACC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IACzE,MAAM,UAAU,GAAG,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,kBAAkB,CACnC,KAAK,CAAC,UAAU,EAChB,QAAQ,EACR,YAAY,CACb,CAAC;IACF,MAAM,qBAAqB,GAAG,kBAAkB,CAC9C,KAAK,CAAC,qBAAqB,EAC3B,QAAQ,EACR,uBAAuB,CACxB,CAAC;IACF,IACE,IAAA,wCAA4B,EAAC,UAAU,CAAC;QACxC,IAAA,wCAA4B,EAAC,qBAAqB,CAAC,EACnD,CAAC;QACD,OAAO,IAAI,CACT,gCAAgC,EAChC,sDAAsD,EACtD,gCAAgC,CACjC,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,sBAAsB,CAClC,KAAK,CAAC,KAAK,EACX,QAAQ,EACR,UAAU,CAAC,iBAAiB,EAC5B,OAAO,CACR,CAAC;IACF,MAAM,WAAW,GAAG,sBAAsB,CACxC,KAAK,CAAC,WAAW,EACjB,QAAQ,EACR,UAAU,CAAC,iBAAiB,EAC5B,aAAa,CACd,CAAC;IACF,IACE,IAAA,wCAA4B,EAAC,KAAK,CAAC;QACnC,IAAA,wCAA4B,EAAC,WAAW,CAAC,EACzC,CAAC;QACD,OAAO,IAAI,CACT,qCAAqC,EACrC,sDAAsD,EACtD,gCAAgC,CACjC,CAAC;IACJ,CAAC;IACD,MAAM,iBAAiB,GAAG,cAAc,CACtC,KAAK,CAAC,iBAAiB,EACvB,kCAAkC,EAClC,IAAI,MAAM,CACR,6CAA6C,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,SAAS,oBAAoB,QAAQ,CAAC,oBAAoB,aAAa,CACjJ,CACF,CAAC;IACF,IAAI,iBAAiB,KAAK,UAAU,CAAC,iBAAiB,EAAE,CAAC;QACvD,OAAO,IAAI,CACT,kCAAkC,EAClC,0DAA0D,EAC1D,gCAAgC,CACjC,CAAC;IACJ,CAAC;IACD,IACE,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,oBAAoB;QAC9C,KAAK,CAAC,MAAM,KAAK,QAAQ;QACzB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC;QAC1C,KAAK,CAAC,oBAAoB,CAAC,MAAM,KAAK,CAAC;QACvC,CAAC,IAAA,wBAAQ,EAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,EACxC,CAAC;QACD,OAAO,IAAI,CACT,gBAAgB,EAChB,oEAAoE,EACpE,gCAAgC,CACjC,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;IAChD,IACE,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ;QAClC,CAAC,kCAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAC5C,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ;QACnC,SAAS,CAAC,SAAS,KAAK,KAAK,EAC7B,CAAC;QACD,OAAO,IAAI,CACT,wCAAwC,EACxC,2DAA2D,EAC3D,gCAAgC,CACjC,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,cAAc,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAC1D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC;QACzC,4BAA4B,EAAE,QAAQ,CAAC,sBAAsB;QAC7D,0BAA0B,EAAE,QAAQ,CAAC,oBAAoB;QACzD,2BAA2B,EAAE,QAAQ,CAAC,uBAAuB;QAC7D,uBAAuB,EAAE,QAAQ,CAAC,UAAU;QAC5C,iBAAiB,EAAE,QAAQ,CAAC,YAAY;QACxC,SAAS,EAAE,QAAQ,CAAC,KAAK;KAC1B,CAAC,EAAE,CAAC;QACH,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;YACpC,OAAO,IAAI,CACT,sDAAsD,IAAI,EAAE,EAC5D,wDAAwD,EACxD,gCAAgC,CACjC,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC7D,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,oBAAoB,EAAE,CAAC;QACxD,OAAO,IAAI,CACT,8CAA8C,EAC9C,mEAAmE,EACnE,gCAAgC,CACjC,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG;QACf,GAAG,QAAQ;QACX,WAAW;QACX,aAAa,EAAE,SAAS,CAAC,IAAI;QAC7B,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,cAAc,EAAE,QAAQ,CAAC,UAAU,CAAC,IAAI;QACxC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,cAAc,EAAE,SAAS,CAAC,KAAK;QAC/B,IAAI,EAAE,uCAA+B;QACrC,UAAU;QACV,QAAQ,EAAE;YACR;gBACE,aAAa,EAAE,IAAA,6BAAiB,EAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;gBAC1D,cAAc,EAAE,IAAA,6BAAiB,EAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC;aAC7D;YACD;gBACE,aAAa,EAAE,IAAA,6BAAiB,EAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC;gBACrD,cAAc,EAAE,IAAA,6BAAiB,EAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC;aACxD;YACD;gBACE,aAAa,EAAE,IAAA,6BAAiB,EAAC,KAAK,CAAC,qBAAqB,CAAC,OAAO,CAAC;gBACrE,cAAc,EAAE,IAAA,6BAAiB,EAAC,KAAK,CAAC,qBAAqB,CAAC,QAAQ,CAAC;aACxE;YACD;gBACE,aAAa,EAAE,IAAA,6BAAiB,EAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC;gBAC3D,cAAc,EAAE,IAAA,6BAAiB,EAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC;aAC9D;SACO;QACV,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,aAAa,EAAE,iDAAyC;QACxD,iBAAiB;KAClB,CAAC;IACF,OAAO,EAAE,GAAG,QAAQ,EAAE,cAAc,EAAE,IAAA,6BAAiB,EAAC,QAAQ,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,SAAgB,6BAA6B,CAC3C,KAAgC,EAChC,QAAoC;IAEpC,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,EAAE,cAAc,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC9C,IACE,KAAK,CAAC,IAAI,KAAK,uCAA+B;QAC9C,KAAK,CAAC,aAAa,KAAK,iDAAyC;QACjE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAC5B,CAAC,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,EAAE,CACvB,IAAA,wCAA4B,EAC1B,KAAK,CAAC,GAAsC,CAAC,CAC9C,KAAK,IAAA,wCAA4B,EAAC,aAAa,CAAC,CACpD;QACD,cAAc,KAAK,IAAA,6BAAiB,EAAC,QAAQ,CAAC,EAC9C,CAAC;QACD,MAAM,IAAI,4BAAgB,CACxB,gCAAgC,EAChC,yBAAyB,EACzB,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/src/supply-chain/errors.d.ts

@@ -0,0 +1,6 @@
+export type SupplyChainFailureClassification = 'supply-chain-input-invalid' | 'supply-chain-inventory-incomplete' | 'supply-chain-lock-drift' | 'supply-chain-action-unpinned' | 'supply-chain-action-inventory-drift' | 'supply-chain-container-mutable' | 'supply-chain-script-unreviewed' | 'supply-chain-policy-denied' | 'supply-chain-exception-expired' | 'supply-chain-scanner-unavailable' | 'supply-chain-sbom-invalid' | 'supply-chain-sbom-omission' | 'supply-chain-artifact-mismatch' | 'supply-chain-blueprint-untrusted' | 'supply-chain-blueprint-snapshot-stale' | 'supply-chain-blueprint-revoked' | 'supply-chain-vendored-conflict';
+export declare class SupplyChainError extends Error {
+    readonly classification: SupplyChainFailureClassification;
+    readonly path: string;
+    constructor(classification: SupplyChainFailureClassification, path: string, message: string);
+}

package/src/supply-chain/errors.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SupplyChainError = void 0;
+class SupplyChainError extends Error {
+    classification;
+    path;
+    constructor(classification, path, message) {
+        super(`${path}: ${message}`);
+        this.classification = classification;
+        this.path = path;
+        this.name = 'SupplyChainError';
+    }
+}
+exports.SupplyChainError = SupplyChainError;
+//# sourceMappingURL=errors.js.map

package/src/supply-chain/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../../../packages/nx/src/supply-chain/errors.ts"],"names":[],"mappings":";;;AAmBA,MAAa,gBAAiB,SAAQ,KAAK;IAE9B;IACA;IAFX,YACW,cAAgD,EAChD,IAAY,EACrB,OAAe;QAEf,KAAK,CAAC,GAAG,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;QAJpB,mBAAc,GAAd,cAAc,CAAkC;QAChD,SAAI,GAAJ,IAAI,CAAQ;QAIrB,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AATD,4CASC"}

package/src/supply-chain/generated-blueprint-trust-command.d.ts

@@ -0,0 +1,4 @@
+import { BLUEPRINT_VERIFICATION_VITEST_CONFIG_SOURCE } from './blueprint-verification-authority.js';
+export { BLUEPRINT_VERIFICATION_VITEST_CONFIG_SOURCE };
+export declare function renderBlueprintVerificationVitestConfig(): string;
+export declare function renderBlueprintTrustCheckCommand(): string;